CVE-2021-20834

Опубликовано: 13 окт. 2021

Источник: nvd

CVSS3: 6.1

CVSS2: 5.8

EPSS Низкий

Описание

Improper authorization in handler for custom URL scheme vulnerability in Nike App for Android versions prior to 2.177 and Nike App for iOS versions prior to 2.177.1 allows a remote attacker to lead a user to access an arbitrary website via the vulnerable App.

Ссылки

https://apps.apple.com/app/nike/id1095459556
Product
Release Notes
https://jvn.jp/en/jp/JVN89126639/index.html
Third Party Advisory
https://play.google.com/store/apps/details?id=com.nike.omega
Product
https://apps.apple.com/app/nike/id1095459556
Product
Release Notes
https://jvn.jp/en/jp/JVN89126639/index.html
Third Party Advisory
https://play.google.com/store/apps/details?id=com.nike.omega
Product

Уязвимые конфигурации

Конфигурация 1

Одно из

cpe:2.3:a:nike:nike:*:*:*:*:*:iphone_os:*:*

Версия до 2.177.1 (исключая)

cpe:2.3:a:nike:nike:*:*:*:*:*:android:*:*

Версия до 2.177.3.3688 (исключая)

EPSS

Процентиль: 57%

0.00344

Низкий

6.1 Medium

CVSS3

5.8 Medium

CVSS2

Дефекты

CWE-862

Связанные уязвимости

GHSA-v53j-jcc3-2p22